CVE-2025-11696CWE-22path-traversal
CVE-2025-11696
published November 11, 2025
What it is
A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to trigger outbound SMB requests, enabling the capture of NTLM hashes.
The record
Technical detail
- CVSS
- 8.9 · NONE
- CVSS v4.0
- Not supplied
- EPSS
- 0.00183 · 7.5th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2025-11-11T19:15Z
References (1)
EPSS history
Timeline